{"id":"CVE-2026-85297","kind":"vulnerability","aliases":["CVE-2026-85297"],"related":[],"title":"Google Cloud Run MCP: bucket squatting lets attackers run code and read source","description":"Bucket Squatting in Google Cloud Run MCP versions prior to 1.11.0 on Google Cloud Platform allows an attacker to intercept and access proprietary source code, execute arbitrary code and exfiltrate data.\n\n\n\nUsers must upgrade to Cloud Run MCP version 1.11.0 or later.","summary":"Cloud Run MCP versions before 1.11.0 are exposed to bucket squatting, where an attacker can take over a storage bucket the tool expects to exist. The sources say an attacker can then intercept and read proprietary source code, execute arbitrary code, and exfiltrate data.","severity":"high","cvss":7.7,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ai-tooling","cloud-run","gcp","google-cloud","mcp"],"not_affected_if":["version-1.11.0-or-later"],"how_to_check":"- Check the installed Cloud Run MCP version against `1.11.0`\n- Review which Cloud Storage buckets the Cloud Run MCP deployment references and confirm each one is owned by your project","fix":"- Upgrade Cloud Run MCP to `1.11.0` or later","status":"open","published_at":"2026-10-26T16:17:23+00:00","first_seen_at":"2026-10-26T16:31:01+00:00","triaged_at":"2026-10-26T16:32:47+00:00","updated_at":"2026-10-26T16:32:47+00:00","category":"ai-tooling","confidence":0.6,"triage":{"at":"2026-10-26T16:32:47Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Cloud Run MCP to `1.11.0` or later","reach":"unknown","title":"Google Cloud Run MCP: bucket squatting lets attackers run code and read source","impact":"high","summary":"Cloud Run MCP versions before 1.11.0 are exposed to bucket squatting, where an attacker can take over a storage bucket the tool expects to exist. The sources say an attacker can then intercept and read proprietary source code, execute arbitrary code, and exfiltrate data.","category":"ai-tooling","nicknames":[],"who_cares":["google-cloud","cloud-run","mcp","gcp"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attacker runs arbitrary code and reads proprietary source code","analyst_note":"Confirm which bucket names are squatted and whether the attack needs any account or setting; check the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-85297 for the vendor advisory.","how_to_check":"- Check the installed Cloud Run MCP version against `1.11.0`\n- Review which Cloud Storage buckets the Cloud Run MCP deployment references and confirm each one is owned by your project","needs_analyst":true,"not_affected_if":["version-1.11.0-or-later"],"who_is_affected":"Teams running Google Cloud Run MCP below version 1.11.0 on Google Cloud Platform. The sources do not say which configurations make a deployment exposed beyond the version, so the bucket ownership check is the practical test.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000623,"input_tokens":3336,"output_tokens":579,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':15A,18A '-85297':16A,19A '1.11.0':36B,85C,114C 'access':96C 'ai':21B 'ai-tool':20B 'allow':90C 'arbitrari':70B,101C 'attack':8A,44B,60B,92C 'bucket':5A,40B,50B,75C 'cloud':2A,24B,29B,31B,79C,88C,110C 'cloud-run':23B 'code':10A,68B,71B,99C,102C 'cve':14A,17A 'data':74B,105C 'execut':69B,100C 'exfiltr':73B,104C 'exist':55B 'expect':53B 'expos':38B 'gcp':26B 'googl':1A,28B,78C,87C 'google-cloud':27B 'intercept':63B,94C 'later':116C 'let':7A 'mcp':4A,30B,33B,81C,112C 'must':107C 'platform':89C 'prior':83C 'proprietari':66B,97C 'read':12A,65B 'run':3A,9A,25B,32B,80C,111C 'say':58B 'sourc':13A,57B,67B,98C 'squat':6A,41B,76C 'storag':49B 'take':46B 'tool':22B,52B 'upgrad':108C 'user':106C 'version':34B,82C,113C","nicknames":[],"mitigations":[],"who_affected":"Teams running Google Cloud Run MCP below version 1.11.0 on Google Cloud Platform. The sources do not say which configurations make a deployment exposed beyond the version, so the bucket ownership check is the practical test.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T16:17:23+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Amber","cvss_by":"f45cbf4e-4146-4068-b7e1-655ffc2c548c","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-85297","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85297","severity":null,"published_at":"2026-10-26T16:17:23+00:00","modified_at":"2026-10-26T16:17:23+00:00","first_seen_at":"2026-10-26T16:31:01+00:00","fetched_at":"2026-10-26T16:31:01+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}